Privacy

What is stored, and where

Your games, their analyses, your puzzle history and your settings are saved in your browser (IndexedDB and localStorage), on your device. Your games and their analyses are not sent to any server.

You can erase them at any time: the dashboard's Delete button for one account, or clearing this site's data in your browser for everything.

The card you publish

Publishing your card is your choice: nothing is sent until you confirm. The published card contains what it shows: your username, the site (Chess.com or Lichess), the time control, your rating and number of games, your class, your traits, your style and skill scores, your favourite openings, and the address of your public profile picture. Your games themselves are not sent.

Before accepting it, the server checks with Chess.com or Lichess that the account exists and that the figures are plausible.

For our statistics, the server also keeps, for each account that publishes, a fingerprint of its Chess.com or Lichess identifier, mixed with a secret value, together with the title, rating and number of games of its latest card and the number of cards published. It is used to count distinct accounts, and does not contain your username.

It is public: anyone with its link can see it. It stays online for 7 days. The following night, its content, your username and your rating are erased; only its code, the site, the time control, the number of games and the dates remain, so that the link can say it has expired. A card removed after a report is kept for one year, as a record of the removal, then erased in the same way. To remove it sooner, write to contact@chessportrait.com.

Your Chess.com and Lichess accounts

The site never asks for your Chess.com or Lichess password. Your public games are read by your browser. The server only reads your public profile to check an account or a card. When you sign in, it keeps no access token: it reads your identity, then gives the access back at once.

Your account

An account is for publishing a permanent card. During the beta, it can only be created by invitation. It keeps your email address, the Chess.com or Lichess profile you proved is yours, your ways of signing in and its creation date. No password: you sign in with a link sent by email, or with Lichess.

To prove a Lichess profile is yours, you go through the Lichess sign-in: the site only reads your identifier and username, then gives the access back at once, keeping nothing. For Chess.com, it reads the “Location” field of your public profile, where you put a code.

A signed-in session is held in a technical cookie, needed to stay signed in: it lasts 30 days, extended while you keep coming back, and the server only keeps a fingerprint of it. A sign-in link expires after 15 minutes.

Your permanent card stays online, at your username's address, as long as the site exists. To take it down, or delete your account, write to contact@chessportrait.com.

The waiting list

If you leave your address to be told when permanent cards open, it is kept with the site's language and the sign-up date. It is only used to send you that announcement, then erased. To be removed sooner, write to contact@chessportrait.com.

Reports

A report records the card concerned, the reason chosen, the details you write and, if you give it, your email address, which is only used to reply to you. A report is kept until it is handled, then for one year, so that removals stay on record; it is then erased.

Your IP address

To limit, per day, publications, reports, sign-in link requests, invitation steps and waiting-list sign-ups, the server computes a fingerprint of your IP address, mixed with a secret value and the current date. The address itself is not stored, and the fingerprint changes every day: it cannot be used to follow you from one day to the next. Each day's counters are erased the next day.

Usage statistics

To understand how the site is used, your browser occasionally sends counters to our server: a visit that day, a view of the home page, a try, games analysed, a card created or published. The server only adds them up, day by day. They contain neither your IP address, nor your username, nor any identifier.

To count each thing only once, and to know where visitors come from, your browser keeps a few markers (localStorage): the day of your last visit, the number of games already counted, and where your first visit came from, for example the card or link that brought you. That origin goes with the counters. Views of a published card are counted by the server, in the same way.

Services contacted

Chess.com and Lichess: when you connect a username, your browser asks them directly for that account's public games and profile, and displays the profile picture they host. Like any website visit, these requests send them your IP address; they are covered by their privacy policies.

Hosting: the site is served by Cloudflare, which also hosts the database of published cards and reports. Like any host, Cloudflare may keep technical logs (IP address, date, page requested) under its own policy.

Resend sends the sign-in emails: it receives your address and the message, which contains the link. Its servers are in the United States.

The Stockfish engine is downloaded from this very site, and runs on your device.

What the site doesn't do

No advertising, no third-party trackers. Your games and your analyses are not collected, sold or shared.

Contact

A question, a problem or a suggestion: contact@chessportrait.com